GDPR

What the GDPR means

The GDPR is the data protection regulation of the European Union. It has applied since 25 May 2018, it does not replace national data protection law but frames it, and it governs the handling of personal data. Personal means any detail that can be related to an identifiable natural person. A name, an address and an email address belong to it, but so does an IP address, a device identifier and a browsing history inside the shop.

For online retail the important part is that almost every step touches personal data. Ordering, paying, shipping and handling a return only work with customer data. The GDPR does not forbid that, it asks for a reason: every processing activity needs a legal basis, a purpose and a period after which the data disappears again.

Which duties follow from it

Four duties carry the operation. First the duty to inform, meaning a privacy policy stating purpose, legal basis, recipients and retention period. Second accountability, meaning documentation of why a processing activity is permitted. Third the rights of the data subject: access, rectification, erasure, restriction, portability and objection. Fourth technical and organisational protection so that data does not go missing.

Anyone using service providers additionally needs a data processing agreement. That covers hosting, payment providers, shipping, newsletter delivery, support tools and, for some time now, every service that produces text or images with AI.

Where it goes wrong in practice

• A consent banner without control: a banner that allows everything is not consent. Scripts that are not necessary may only load after an active choice.
• Outdated texts: a privacy policy from 2019 does not name the services running today. It has to reflect the tools actually in use.
• Missing processing agreements: the contract is checked for hosting and forgotten for the newsletter tool.
• No deletion concept: without periods, order data stays in the system forever. Retention duties explain many periods, but not all of them.

Frequent questions

• Does every shop need a data protection officer? Only under certain conditions, for instance with extensive regular monitoring. The assessment has to be documented.
• May I show customer reviews with names? Only with permission or a solid legal basis. The full name is not needed for a review.
• Does the GDPR apply to newsletters as well? Yes, and it requires an explicit opt-in here that can be proven.